ECE Sysadmin Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== If Antivirus causes mail in your Inbox to disappear ======

Sometimes antivirus software, including Symantec AV, may detect a virus in an incoming email message. In some cases, this can cause all the earlier messages in your email "Inbox" list to disappear. The reason this happens is that the "real-time virus protection" sees the changes to the one large file holding your entire Inbox, and in scanning the content of the changes it detects the arriving email virus. It can respond by placing the entire Inbox file into its virus "quarantine." The file is not actually gone, but it is kept inaccessible in the quarantine to stop access to the virus.



===== How to recover messages =====

  * In your email program, file any very recent messages that landed in your INBOX since this happened - transfer them to some other mail folder so the Inbox is empty (that will include this message as well!). Quit from the email program.

  * Right click on the small yellow "shield" icon in the system tray at the far lower right of the screen, and choose "Open Symantec Antivirus."

  * In the left column of the Symantec window, find "Histories" and if there is a Plus sign beside it, click that to expand the list under it. In the list under Histories, click Risk History. This will show a list of files that Symantec has "quarantined" because it detected a virus inside. Look for a filename of "INBOX". It should show a recent date and time, matching the time you found your email messages went away.

  * If you find this, RIGHT-click on it and choose "Properties." In the properties window, find the file path, such as "C:\Documents and Settings\etc\etc\etc" - you may have to widen the column in the table to see the full path. Write down the full file path.

  * Go back into Symantec AV. Click in the left column on Scans; under that, click on "full Scan". On the right side, click on Options... Near the bottom left of Scan Options, find the checkbox for "Exclude files and folders" and click it to check this option. The Exclusions button to the right becomes active; click it. In the exclusions window, click "Files/Folders". 

  * In the "Select Items" windows, click the plus-sign beside drive C, then click more such plus signs beside each folder in the file path you wrote down for the INBOX file (probably "Documents and Settings" then your name, etc - follow the file path you wrote down.

  * When you reach the folder containing INBOX, click on that folder to place a checkmark beside the folder name. This tells symantec not to scan inside that folder, so we can prevent it from quarantining your entire Inbox again.

  * Next, click OKAY to close all the windows we just opened, until you get back to the Symantec window. In the left column, click on VIEW, and under VIEW click on Quarantine. Find the INBOX file, right-click on it, and choose "Restore" to put it back where it was removed from.

  * Now you can open your email program and you should see all the email messages that were hidden. (Recall that newer messages since that event have all been moved to another mail folder at step 1.)